The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Health and Human Services (HHS), U.S. Department of Agriculture (USDA) and Department of Transportation (DOT) have warned of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems worldwide. The agencies said threat actors are targeting electronic temperature controllers and commercial refrigeration controllers used in retail grocery stores and cold storage facilities across the healthcare and public health, chemical, food and agriculture, and transportation systems sectors.
In a fact sheet released on Thursday, the agencies flagged that the attackers may exploit unpatched or internet-accessible devices through authentication bypass, arbitrary code injection and weak configurations to remotely manipulate temperature settings, trigger continuous heating and defrost cycles, disrupt temperature visibility, cause inventory losses and create equipment and fire hazards. They urged industrial refrigeration and cold chain operators to eliminate direct public internet exposure of control systems, isolate operational technology (OT) devices from business networks and strengthen authentication through password changes and phishing-resistant multifactor authentication.
“In close collaboration with our government, industry and international partners, CISA is actively tracking this threat activity,” Chris Butera, CISA’s acting executive assistant director for cybersecurity, said in a media statement. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target. We urge you to review the joint fact sheet and take action now to close known security gaps.”
“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” said Brett Leatherman, FBI’s Cyber Branch Operations director. “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk. This fact sheet provides clear, practical steps that network defenders can take to reduce that risk and protect operations. The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI.”
The advisory comes as hackers have hijacked supermarket refrigeration systems across Europe twice in three weeks. The most recent wave struck on Nov. 2, when refrigeration systems were disrupted across at least seven European Union countries and more than 100 stores and other businesses reported problems. Belgian refrigeration firm Sabcobel said attackers had accessed cooling systems and switched evaporators into defrost mode, causing temperatures to rise. Equipment supplier Danfoss said some systems targeted in the Netherlands remained connected to unsecured networks and were still using default passwords.
The attacks followed an earlier incident overnight on Oct. 11-12, when unidentified hackers gained remote access to software controlling temperatures in refrigerators, freezers and cold-storage rooms used by major French supermarket chains. Fridges and freezers at hundreds of stores reportedly surged to as high as 50 degrees Celsius, and some stores reported fires triggered by the overheating equipment. No organisation has claimed responsibility, and authorities have not established whether the incidents share a common perpetrator.
Across the Atlantic, European authorities have escalated their response. In a joint statement, the European Commission and the EU Agency for Cybersecurity (ENISA) detailed that commercial refrigeration systems and similar devices in several EU Member States have been hit by cybersecurity incidents since Oct. 11.
Citing the large-scale nature of the activity, the agencies stressed that cooperation, rapid information-sharing, and coordinated response at the European level are essential. Following a new wave of incidents on Nov. 1-2, ENISA, the Commission’s DG CNECT, Europol’s European Cybercrime Centre (EC3), the EU CSIRTs Network, and the European cyber crisis liaison organisation network (EU-CyCLONe) advised organizations to take immediate action to reduce exposure in the affected systems. The affected Member States are investigating the incidents and issuing guidance, while the CSIRTs Network and EU-CyCLONe continue to exchange information and monitor the situation. ENISA is also maintaining a collection of advisories published by CSIRTs Network members.
The statement also pointed organizations to the EU’s evolving regulatory framework. Since Sept. 11, manufacturers of hardware and software products have been required to report severe incidents and actively exploited vulnerabilities through the Single Reporting Platform under the Cyber Resilience Act (CRA). The CRA’s main cybersecurity requirements will apply from Dec. 11, 2027, obliging manufacturers to build in security by design, provide security support across the product lifecycle, and remediate vulnerabilities without delay.
Also, entities covered by the NIS2 Directive must implement cybersecurity risk management measures and report significant incidents to their national CSIRT or competent authority. ENISA added that it is promoting secure-by-design and secure-by-default principles across the EU market, including through its Secure by Design and Default Playbook and regular technical advisories on product security.
Duncan Greatwood, CEO at Xage Security, said that attackers didn’t steal a single file. They just turned up the thermostat, and that was enough to empty the shelves.
“The latest wave of cyberattacks on supermarket refrigeration systems across Europe should be a wake-up call for the United States,” Greatwood wrote in an emailed statement. “American grocers use similar technology, and the Pentagon is reportedly already investigating suspected attacks on refrigeration systems at military commissaries. If this can happen to a supermarket in Stockholm, it can happen in Ohio. The incidents show that the food supply chain is now a cybersecurity issue. Attackers can cause real economic damage, and potentially cause fears of shortages, simply by manipulating the technology that keeps essential goods safe and available.”
Greatwood said that for companies that run refrigeration, production lines and other physical systems, patching matters, but it isn’t enough on its own. “They must focus on resilience, which means assuming attackers will find a way in and ensuring they cannot turn a single compromised device or credential into a widespread operational disruption. The smartest defense is to hide critical equipment from anyone who doesn’t need it. If an attacker gets into a store’s network but can’t even see the refrigeration controls, they can’t turn up the heat. Attackers roam networks looking for something to break. The answer is to make sure there’s nothing for them to find.”
“Organizations can start by checking whether refrigeration controllers can be reached directly from the internet, including through maintenance providers’ cellular connections. Remove unnecessary public access and require authenticated, restricted access for remote maintenance,” Guy Waizel, tech evangelist at Cato Networks, wrote in an emailed statement. “They should replace default or shared passwords with individual accounts, require multifactor authentication at the remote-access gateway where devices cannot support it, and limit who can change settings. Separate refrigeration systems from office networks and other sites, and coordinate firmware updates with equipment suppliers.”
He added that organizations should also monitor unexpected changes to temperatures, settings and alarms. Independent temperature monitoring can help detect cooling failures even if the controller’s own alarms have been altered.
“Organizations using Danfoss AK-SM or AK-SC controllers, or Copeland/Dixell XWEB systems, should check the vendor’s security guidance for their exact model and firmware version. Published research has documented vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro controllers, but their exploitation in the reported refrigeration attacks has not been confirmed,” Waizel noted. “Where updates cannot be applied immediately, restrict access and consider network-based protection against applicable exploits while coordinating remediation with the equipment supplier.”
In the advisory, the agencies urged operators to keep device firmware current and to set up a structured lifecycle process for identifying, retiring, and replacing end-of-life equipment the manufacturer no longer supports, pointing to CISA’s binding operational directives on risk-based security updates and end-of-support edge devices for further guidance. They also recommended allowlisting so that only authorized devices and IP addresses can make changes, along with current offsite and offline backups that are regularly tested. Operators should enable logging and review logs for unexpected activity, and where OT assets lack standard logs, collect network traffic and communications between the assets instead. The agencies also advised setting safe temperature limits for equipment downstream of controllers and configuring alerts for any deviation.
The guidance aligns with the CISA and National Institute of Standards and Technology cross-sector Cybersecurity Performance Goals and calls on organizations to secure any necessary remote access through firewalls or edge devices and to monitor OT environments regularly for suspicious activity.
